PkgSeer

Vulnerability GO-2026-5020

Unknown

5 months ago

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

v0.1.0 - v0.51.0

Summary

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

Details

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

v0.1.0 - v0.55.0 GO-2026-6354

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

v0.1.0 - v0.55.0 GO-2026-6355

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

v0.1.0 - v0.54.0 GO-2026-6303

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

v0.1.0 - v0.58.0 GO-2026-5932

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg

View all vulnerabilities for these packages

Impacted packages

golang.org/x/crypto

Timeline

Published

5 months ago

Fixed (v0.52.0)

5 months ago

Last Modified

6 hours ago